Shopify · Report #756729
Stored XSS in Shopify Chat
Validstatus
lowseverity
$500bounty
106upvotes
23 Dec 2019disclosed
How it was found
1.install app Shopify Chat
2.Click chat on the shop homepage or Shopify Ping to send poc javascript:alert(1)//https://dqdqdqdqdq.myshopify.com
3.Click url, alert
{F657395}
Impact
1.Front end user Self-XSS 2.Administrator XSS foreground user